ixigo Data Breach (2019): What Was Exposed & What To Do
SourceBreach data provided in part by Have I Been Pwned, used under CC BY 4.0.
The ixigo Data Breach (2019) (reported January 3, 2019) exposed Auth tokens, Device information, Email addresses and Genders belonging to roughly 17.2M people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The breach at ixigo was reported on 3 January 2019. Public information states that the incident involved 17.2 million records. The data set later surfaced on an underground marketplace the next month. No further details on the timing, method of access, or exact scale beyond the reported figures have been disclosed.
How a breach like this happens
Incidents involving large volumes of customer records from online platforms often begin with unauthorised access to databases or application servers. Attackers may exploit vulnerabilities in web applications, obtain credentials through separate compromises, or purchase initial access from other actors. Once inside, they can copy authentication tokens, user profiles, and hashed credentials before the activity is detected. The subsequent appearance of the data on marketplaces is a common pattern when the goal is financial gain through resale.
ixigo and its sector
ixigo operates as a travel and hotel booking platform. Companies in this sector routinely collect and store account details, contact information, and identifiers that link users across services. A breach at such a firm is consequential because the records can be combined with data from other sources to build detailed profiles of individuals who book travel.
What data was at risk
The records named in connection with the incident include the following categories:
- Auth tokens
- Device information
- Email addresses
- Genders
- Names
- Passwords
- Phone numbers
- Salutations
Additional references to Facebook profile connections and MD5-hashed passwords appear in descriptions of the data offered for sale. The precise contents of every record remain unconfirmed beyond these reported fields.
Why it matters
For individuals, exposed email addresses and phone numbers increase the chance of receiving targeted phishing messages or unwanted contact. Hashed passwords, even when stored as MD5, can be tested against common values, and auth tokens may allow access to accounts without the original password. For the organisation, the incident highlights the value attackers place on travel-platform data sets that contain verified contact details and cross-service identifiers.
What to do if you're exposed
Change passwords on ixigo and any other accounts that reuse the same credentials. Enable multi-factor authentication where available and monitor email and phone accounts for unusual login attempts. Readers can run a free exposure scan of their email address to check whether their information appears in known breach data sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Sonicbids Data Breach (2019)Go Ninja Data Breach (2019)GameSprite Data Breach (2019)Avvo Data Breach (2019)Latest breaches
Read GalaxyWarden’s full analysis of the ixigo Data Breach (2019) →
Verified breach. Breach data provided in part by Have I Been Pwned, used under CC BY 4.0.
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.